7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27616

CVE-2026-27616: Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as <script> tags or event handlers like onload. The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user. Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload. Version 2.0.0 patches this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27616

CVE-2026-27616:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 0.24.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored XSS caused by the inline rendering of user-uploaded SVG files. The vulnerability description explicitly mentions that 'SVG attachments are rendered inline instead of being forced as a download'. The recommended mitigation is to 'Serve attachments with Content-Disposition: attachment to prevent inline rendering'.

By analyzing the commits between the last vulnerable version (0.24.6) and the first patched version (v2.0.0), I identified commit 4915f535d0a815698ce1af43491b13b6683ec527. This commit directly addresses the issue.

The commit modified the GetTaskAttachment function in pkg/routes/api/v1/task_attachment.go. The patch changes the Content-Disposition header from inline to attachment. This change prevents the browser from rendering the SVG file and instead prompts the user to download it, thus mitigating the stored XSS vulnerability.

The vulnerable function is therefore GetTaskAttachment, as it was the function responsible for serving the malicious file with the insecure header. Other commits I analyzed (329c07f24b27b0238aa0bd02ae9b4003b13387d4 and d222d4502acdf9d235880d3675d2dcf7f18e1d85) are related follow-up fixes to the same function and header, confirming that this was the area of the code containing the vulnerability.

Vulnerable functions

v1.GetTaskAttachment

pkg/routes/api/v1/task_attachment.go

This function serves task attachments. Before the patch, it set the `Content-Disposition` header to `inline`. This caused browsers to render SVG files in the context of the application's origin, allowing embedded JavaScript to execute, which led to a stored XSS vulnerability. The fix changes the disposition to `attachment`, forcing a download and preventing inline execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.